Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise. Learn more →
Top 23 Rust Authentication Projects
-
-
AppSignal
AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
-
trailbase
An open, sub-millisecond, single-executable Firebase alternative with type-safe APIs, built-in WebAssembly runtime, realtime subscriptions, auth, MCP and admin UI built on Rust, SQLite (PG) & Wasmtime.
Project mention: Trailbase: Fast, single-executable, open app platform built on Rust and SQLite | news.ycombinator.com | 2025-12-16 -
-
Ockam
Orchestrate end-to-end encryption, cryptographic identities, mutual authentication, and authorization policies between distributed applications – at massive scale.
-
-
GlobalProtect-openconnect
A GlobalProtect VPN client for Linux, written in Rust, based on OpenConnect and Tauri, supports SSO with MFA, YubiKey, and client certificate authentication, etc.
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
-
sudo_pair
Plugin for sudo that requires another human to approve and monitor privileged sudo sessions
-
-
-
-
Project mention: Show HN: Gaze – Facial Authentication for Linux | news.ycombinator.com | 2026-08-06
-
torii-rs
Torii is a powerful authentication framework for Rust applications that gives you complete control over your users' data.
-
-
Project mention: Show HN: PidgeIoT – open-source IoT/Embedded device management for all (free*) | news.ycombinator.com | 2026-07-28
And now for some answers to questions I expect
- Q: Is it self-hostable?
- A: Well yes, but actually no. You can self-host Ory Kratos and PG. The core is deployable to your own Cloudflare account, but can't be run on bare metal (well technically it could, but you shouldn't). I would like to make a fully self-hostable version in the future, but that's low on the priority list right now.
- Q: Why not use JWTs for device authentication?
- A: 1. JWTs are a poor design; See: https://github.com/jedisct1/rust-jwt-simple#why-yet-another-... 2. JWTs are stateless tokens that are valid for their lifetime. That makes revoking them a pain; See: https://stackoverflow.com/a/40385939
- Q: AGPL in my firmware!? Isn't that going to infect my firmware and make it yours?
- A: No, AGPL binds people modifying/serving PidgeIoT itself, and the device talks over a documented HTTP protocol; your firmware is yours.
- Q: Have you heard of ThingsBoard?
- A: I have heard of ThingsBoard, I even tried it out! It's good software and I hope to meet their functionality in the future. With that said...
I feel it has a severe lack of simplicity and a high barrier to entry. Somewhat similar to AWS, ThingsBoard is a product family with per-product licensing. I want one coherent service. Not a tangled mess that requires a degree to set up (exaggeration, but you get my point).
Easy to use, easy to scale, one product, one price, open protocol, etc, etc.
Just one accessible service.
I also plan on enabling Cloudflare's Workers for Platforms which gives users their own data-processing workers. That's pretty much synonymous to ThingsBoard's rule engine, without the fragile (IMO) visual rule chains.
-
Biscuit is a bearer token format with three properties that fit this problem.
-
Project mention: Sessions vs JWTs: you are choosing how often you pay for state | dev.to | 2026-08-31
A JWT is signed, not encrypted. Anyone holding the token can read every claim inside it. jwt.io will do it for you in a browser.
-
nforwardauth
Simple and minimalist forward auth service intended for use with reverse proxies (Traefik, Caddy, nginx, etc)
-
-
-
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Rust Authentication discussion
Rust Authentication related posts
-
Delegating authority across companies with Biscuit tokens
-
I close SSH port 22 (and what I use instead)
-
Show HN: Reinhardt – Rust web framework with WASM front end, admin, DI, and ORM
-
Show HN: Reinhardt – Django-style Rust framework; WASM+SSR from one DSL
-
Trailbase: Fast, single-executable, open app platform built on Rust and SQLite
-
TrailBase: Fast, open, single-executable BaaS
-
Lldap Release v0.6.0
-
A note from our sponsor - AppSignal
www.appsignal.com | 10 Oct 2026
Index
What are some of the best open-source Authentication projects in Rust? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | lldap | 6,550 |
| 2 | trailbase | 5,639 |
| 3 | kanidm | 5,441 |
| 4 | Ockam | 4,637 |
| 5 | defguard | 2,865 |
| 6 | GlobalProtect-openconnect | 2,280 |
| 7 | rust-jwt | 2,098 |
| 8 | rauthy | 1,363 |
| 9 | sudo_pair | 1,272 |
| 10 | axum-login | 1,022 |
| 11 | openidconnect-rs | 644 |
| 12 | internet-identity | 535 |
| 13 | gaze | 489 |
| 14 | torii-rs | 456 |
| 15 | cotp | 390 |
| 16 | rust-jwt-simple | 282 |
| 17 | biscuit-rust | 252 |
| 18 | frank_jwt | 251 |
| 19 | nforwardauth | 157 |
| 20 | pam | 91 |
| 21 | openid | 86 |
| 22 | sspi-rs | 84 |
| 23 | casbin-axum-casbin | 72 |
Sponsored
AppSignal knows why the f*#k it crashed.
Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.
www.appsignal.com